6.14 Steering of roaming security mechanism

33.5013GPPRelease 18Security architecture and procedures for 5G SystemTS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

6.14.1 General

This clause describes the security functions necessary to support steering of the UE in the VPLMN during registration procedure and also after registration as described in TS 23.122 [53] Annex C. The security functions are described in the context of the functions supporting the control plane solution for steering of roaming in 5GS.

If the control plane solution for Steering of Roaming is supported by the HPLMN, the AUSF shall store the latest K_AUSF after the completion of the latest primary authentication.

The content of the Steering List as well as the conditions for sending it to the UE are described in TS 23.122 [53] Annex C. The Steering List includes either a list of preferred PLMN/access technology combinations, a secured packet or the HPLMN indication that ‘no change of the "Operator Controlled PLMN Selector with Access Technology" list stored in the UE is needed and thus no list of preferred PLMN/access technology combinations is provided’.

NOTE: The Steering of Roaming Information is defined in clause 1.2 of TS 23.122 [53]. It contains thus the ACK indication, the Steering List and the integrity protection information.

6.14.2 Security mechanisms

6.14.2.1 Procedure for steering of UE in VPLMN during registration

The security procedure for the case where the UE registers with VPLMN AMF is described below in figure 6.14.2.1-1:

Figure 6.14.2.1-1: Procedure for providing list of preferred PLMN/access technology combinations during registration in VPLMN

1) The UE initiates registration by sending Registration Request message to the VPLMN AMF.

2-3) The VPLMN AMF executes the registration procedure as defined in sub-clause 4.2.2.2.2 of 3GPP TS 23.502 [8]. As part of the registration procedure, the VPLMN AMF executes primary authentication of the UE and then initiates the NAS SMC procedure, after the authentication is successful.

4-5) The VPLMN AMF invokes the Nudm_UECM_Registration message to the UDM and registers access with the UDM as per step 14a in sub-clause 4.2.2.2.2 of 3GPP TS 23.502[8].

6) The VPLMN AMF invokes Nudm_SDM_Get service operation message to the UDM to get amongst other information the Access and Mobility Subscription data for the UE (see step 14b in sub-clause 4.2.2.2.2 of 3GPP TS 23.502 [8]).

7) The UDM decides to send the Steering of Roaming Information, and obtains a list of preferred PLMN/access technology combinations and optional additional SoR information (e.g. SOR-CMCI and the "Store the SOR-CMCI in the ME" indicator), or a secured packet list as described in TS 23.122 [53].

NOTE 1: Additional SoR information (e.g. SOR-CMCI and the "Store the SOR-CMCI in the ME" indicator) can only be added when the AMF supports SoR transparent container.

If the UDM determines that the UE is configured to not expect to receive Steering of Roaming Information at initial registration and if the UDM determines that no change of the "Operator Controlled PLMN Selector with Access Technology" list stored in the UE is needed, then the UDM may not piggyback Steering of Roaming Information at all in the Nudm_SDM_Get response and hence the following steps are omitted.

8-9) The UDM shall invoke Nausf_SoRProtection service operation message to the AUSF to get SoR-MAC-I_AUSF and Counter_SoR as specified in sub-clause 14.1.3 of this document. The UDM shall select the AUSF that holds the latest K_AUSF of the UE.

If the HPLMN decides that the UE is to acknowledge the successful security check of the received Steering of Roaming Information, then the UDM shall set accordingly the ACK Indication included in the Nausf_SoRProtection service operation message to signal that it also needs the expected SoR-XMAC-I_UE, as specified in sub-clause 14.1.3 of this document.

NOTE 2: At reception of Nausf_SoRProtection_Protect request from the UDM, if the SoR header is not included in the request, the AUSF constructs the SOR header, as described in clause 9.11.3.51 of TS 24.501 [35], based on the information received from the UDM, i.e. ACK Indication and list of preferred PLMN/access technology combinations or secured packet (if provided); otherwise, if the SoR header is contained in the request, the AUSF uses the received SoR header in the calculation of SoR-MAC-I_AUSF..

The details of the Counter_SoR are specified in sub-clause 6.14.2.3 of this document. The inclusion of the Steering List and the SoR header in the calculation of SoR-MAC-I_AUSF allows the UE to verify that the received Steering of Roaming Information is not tampered with or removed by the VPLMN. The expected SoR-XMAC-I_UE allows the UDM to verify that the UE received the Steering of Roaming Information.

10) The UDM responds to the Nudm_SDM_Get service operation to the VPLMN AMF, which shall include the SoR transparent container as specified in clause 6.1.6.3.2 of TS 29.503 [93] if the VPLMN AMF support SoR transparent container, or shall include individual IEs comprising the ACK Indication, the list of preferred PLMN/access technology combinations or secured packet (if provided), SoR-MAC-I_AUSF and Counter_SoR within the Access and Mobility Subscription data. If the UDM requests an acknowledgement, it shall temporarily store the expected SoR-XMAC-I_UE.

11) If the SoR transparent container is received from the UDM, the VPLMN AMF shall include the received SoR transparent container in the Registration Accept message and send it to the UE. If the individual IEs are received from the UDM, the VPLMN AMF shall construct the SOR header based on the ACK Indication and the list of preferred PLMN/access technology combinations or secured packet (if provided) received from the UDM and include it in the SOR transparent container as specified in clause 9.11.3.51 of TS 24.501 [35]. The vPLMN shall also include SoR-MAC-I_AUSFand Counter_SoR(both also received from the UDM) in the constructed SoR transparent container, and convey the constructed SoR transparent container to the UE in the Registration Accept message.

12) On receiving the Registration Accept message with the SoR transparent container from the AMF the UE shall calculate the SoR-MAC-I_AUSF in the same way as the AUSF (as specified in Annex A.17) on the SoR transparent container, including the Counter_SoR and the SoR header, and verifies whether it matches the SoR-MAC-I_AUSF value received in the Registration Accept message. Based on the SoR-MAC-I_AUSF verification outcome, the behaviour of the UE is specified in TS 23.122 [53].

13) If the UDM has requested an acknowledgement from the UE and the UE verified that the SoR transparent container received in step 12 has been provided by the HPLMN, then the UE shall send the Registration Complete message to the serving AMF. The UE shall generate the SoR-MAC-I_UEas specified in Annex A.18 and includes the generated SoR-MAC-I_UEin a SOR transparent container in the Registration Complete message.

14) The AMF sends a Nudm_SDM_Info request message to the UDM. If a transparent container with the SoR-MAC-I_UE was received in the Registration Complete message, then if the AMF supports SoR transparent container, the AMF shall include the received SoR transparent container in SoR transparent container in the Nudm_SDM_Info request message, otherwise, the AMF shall include the SoR-MAC-I_UE in the received SoR transparent container in the Nudm_SDM_Info request message.

15) If the HPLMN indicated that the UE is to acknowledge the successful security check of the received Steering of Roaming Information in step 10, then the UDM shall compare the received SoR-MAC-I_UE with the expected SoR-XMAC-I_UE that the UDM stored temporarily in step 10.

6.14.2.2 Procedure for steering of UE in VPLMN or HPLMN after registration

The security procedure for the steering of UE in VPLMN after registration is described below in figure 6.14.2.2-1:

Figure 6.14.2.2-1: Procedure for providing list of preferred PLMN/access technology combinations after registration

1) The UDM decides to notify the UE of the changes to the Steering of Roaming Information by the means of invoking Nudm_SDM_Notification service operation.

2-3) The UDM shall invoke Nausf_SoRProtection service operation message by including the ACK Indication and optionally the list of preferred PLMN/access technology combinations or secured packet or SoR transparent container (only if transparent container is supported by the AMF) to the AUSF to get SoR-MAC-I_AUSF and Counter_SoR as specified in sub-clause 14.1.3 of this document. The UDM shall select the AUSF that holds the latest K_AUSF of the UE.

If the HPLMN decided that the UE is to acknowledge the successful security check of the received Steering of Roaming Information, then the UDM shall set accordingly the ACK Indication included in the Nausf_SoRProtection service operation message to signal that it also needs the expected SoR-XMAC-I_UE, as specified in sub-clause 14.1.3 of this document.

NOTE: At reception of Nausf_SoRProtection_Protect request from the UDM, if the SoR header is not included in the request, the AUSF constructs the SOR header, as described in clause 9.11.3.51 of TS 24.501 [35], based on the information received from the UDM, i.e. ACK Indication and optionally the list of preferred PLMN/access technology combinations or secured packet; otherwise, if the SoR header in contained in the request, the AUSF uses the received SoR header in the calculation of SoR-MAC-I_AUSF..

The details of the Counter_SoR are specified in sub-clause 6.14.2.3 of this document. The inclusion of the Steering List and the SOR header in the calculation of SoR-MAC-I_AUSF allows the UE to verify that the Steering of Roaming Information received is not tampered with or removed by the VPLMN. The inclusion of these information in the calculation of the expected SoR-XMAC-I_UE allows the UDM to verify that the UE received the Steering of Roaming Information.

4) The UDM shall invoke Nudm_SDM_Notification service operation, which contains the SoR transaprent container as specified in clause 6.1.6.3.2 of TS 29.503 [93] if the VPMN AMF support SOR transparent container, or contains individual IEs including an optional the list of preferred PLMN/access technology combinations or secured packet, the ACK Indication, SoR-MAC-I_AUSF, and Counter_SoRwithin the Access and Mobility Subscription data. If the UDM requests an acknowledgement, it shall temporarily store the expected SoR-XMAC-I_UE.

5) Upon receiving the Nudm_SDM_Notification message, if the SoR transparent container is included in the message, the AMF shall send a DL NAS Transport message to the served UE. including the received SoR transparent container; otherwise, the AMF shall construct the SOR transparent container (including the SOR header) as specified in clause 9.11.3.51 of 3GPP TS 24.501 [35] based on the ACK Indication, the Steering List, SoR-MAC-I_AUSF and Counter_SoR received from the UDM, and send the constructed SoR transparent container included to the served UE in a DL NAS Transport message.

6) On receiving the DL NAS Transport message, the UE shall calculate the SoR-MAC-I_AUSF in the same way as the AUSF (as specified in Annex A.17) on the received SoR transparent container, including the Counter_SoR and the SoR header and verify whether it matches the SoR-MAC-I_AUSF value received in the DL NAS Transport message.

7) If the UDM has requested an acknowledgement from the UE and the UE verified that the Steering Information has been provided by the HPLMN, then the UE shall send the UL NAS Transport message to the serving AMF. The UE shall generate the SoR-MAC-I_UEas specified in Annex A.18 and includes the generated SoR-MAC-I_UEin a SOR transparent container in the UL NAS Transport message.

8) The AMF shall send a Nudm_SDM_Info request message to the UDM. If a SOR transparent container with the SoR-MAC-I_UE was received in the UL NAS Transport message, the AMF shall include the received SoR transparent container in the Nudm_SDM_Info request message if the AMF supports SoR transparent container, otherwise, the AMF shall include the SoR-MAC-I_UE in the Nudm_SDM_Info request message.

9) If the HPLMN indicated that the UE is to acknowledge the successful security check of the received Steering of Roaming Information, then the UDM shall compare the received SoR-MAC-I_UE with the expected SoR-XMAC-I_UE that the UDM stored temporarily in step 4.

6.14.2.3 SoR Counter

The AUSF and the UE shall associate a 16-bit counter, Counter_SoR, with the key K_AUSF.

The UE shall initialize the Counter_SoR to 0x00 0x00 when the newly derived K_AUSF is stored (see clause 6.2.2.2). The UE shall store the SoR counter. If the USIM supports both 5G parameters storage and 5G parameters extended storage, then CounterSoR shall be stored in the USIM. Otherwise, CounterSoR shall be stored in the non-volatile memory of the ME

To generate the SoR-MAC-I_AUSF, the AUSF shall use the Counter_SoR. The Counter_SoR shall be incremented by the AUSF for every new computation of the SoR-MAC-I_AUSF. The Counter_SoR is used as freshness input into SoR-MAC-I_AUSF and SoR-MAC-I_UE derivations as described in the Annex A.17 and Annex A.18 respectively, to mitigate the replay attack. The AUSF shall send the value of the Counter_SoR (used to generate the SoR-MAC-I_AUSF) along with the SoR-MAC-I_AUSF to the UE. The UE shall only accept Counter_SoR value that is greater than stored Counter_SoR value. The UE shall store the received Counter_SoR,onlyif the verification of the received SoR-MAC-I_AUSF is successful. The UE shall use the stored Counter_SoR received from the HPLMN, when deriving the SoR-MAC-I_UE for the SoR acknowledgement.

The AUSF and the UE shall maintain the Counter_SoR for lifetime of the K_AUSF.

The AUSF that supports the control plane solution for steering of roaming shall initialize the Counter_SoR to 0x00 0x01 when the newly derived K_AUSF is stored (see clause 6.2.2.1). The AUSF shall set the Counter_SoR to 0x00 0x02 after the first calculated SoR-MAC-I_AUSF, and monotonically increment it for each additional calculated SoR-MAC-I_AUSF. The SoR Counter value of 0x00 0x00 shall not be used to calculate the SoR-MAC-I_AUSFand SoR-MAC-I_UE.

The AUSF shall suspend the SoR protection service for the UE, if the Counter_SoR associated with the K_AUSF of the UE, is about to wrap around. When a fresh K_AUSF is generated for the UE, the Counter_SoR at the AUSF is reset to 0x00 0x01 as defined above and the AUSF shall resume the SoR protection service for the UE.